The Rhysida hacking group has published a massive archive of data stolen from Berlin's administration on the darknet. This was reported by Qazaqyia.kz citing Euronews.
The archive contains approximately 1.4 million files totaling about 5.8 terabytes. The leak includes not only ordinary work documents. Hackers claim to have accessed personnel, legal, and financial materials. Among the files may also be medical documents, correspondence, bank account data, IBAN numbers, and documents with employees' personal data.
The published archive contains birth certificates, phone numbers, and home addresses of civil servants. There are also lists of absent employees and various personnel documents.
Of particular concern is a folder named "AG CBRN-Rahmenplanung." The abbreviation CBRN stands for chemical, biological, radiological, and nuclear threats. It may contain documents related to authorities' emergency planning.
According to investigative journalist Lars Winkelsdorf, the scale of the attack is so vast that it could pose a threat to the state. Among the stolen materials are said to be police documents, information about critical infrastructure facilities, and emergency response plans.
The attack became known on August 14. According to German media, hackers gained network access between August 7 and 12. After the breach was detected, several agencies were disconnected from the city-wide network. Full connectivity was only restored on August 23.
Rhysida demanded 30 bitcoins—about 2 million euros—from Berlin authorities. The hackers gave officials until September 4 and threatened to publish the stolen data.
The authorities refused to pay. After the ultimatum expired, the group placed the archive on the darknet. Now other users can download the files.
The leak occurred just weeks before Berlin's municipal elections, scheduled for September 20. Experts therefore do not rule out a political motive for the attack.
Rhysida is known for major attacks on state and public organizations. Previously, the group hacked the British Library and, after the refusal to pay a ransom, also published the stolen data.
Earlier, Kursiv LifeStyle reported that a new leak of GTA 6 materials was linked to protests against digital pre-orders. The hacker group Cyberleek, which claimed responsibility for the "dump," published a manifesto with demands to game publishers.